The vulnerability lies in hardcoded AES passphrases embedded within the Securly Chrome Extension’s securly.min.js file. These plaintext keys are used to decrypt crisis alert keyword data and intervention site data, thereby allowing an attacker to compromise the confidentiality of such sensitive information. The flaw represents an improper handling of cryptographic keys, granting potential exposure of operational details that could affect user privacy and security.

The Securly Chrome Extension, version 3.0.7, is affected. No other versions or product variants are listed.

The EPSS score is < 1%, and the vulnerability is not on CISA’s KEV list, indicating no known high‑profile exploitation activity yet. However, the presence of plaintext decryption keys in the client‑side code provides a direct avenue for attackers who can analyze or tamper with the extension in a user’s browser. The likely attack vector is local code assessment or malicious injection into the extension’s context. With a CVSS score of 7.3, the risk is considered high, but it could be escalated if the extension is compromised.